[Feature]: Comments on files and folders with @mentions

[DenizAltunkapan]

Problem

Files in the cloud are static: a user can store and open a document, but there is no way to leave feedback, context, or a discussion on it. For a workspace where files are shared between users, the natural next step after viewing and sharing is being able to comment on a file or folder and pull specific people into that conversation.

Example: two users share a document. One wants to leave a note asking a question and tag the other person so they see it. Today they have to switch to a separate chat and describe which file they mean, losing the connection to the document.

Proposed solution

Add comments on files and folders, with @mentions of other Vault Web users.

Scope:

• add, list, and delete comments on a file or folder
• @mention other users in a comment, resolved against existing accounts
• comments are visible to users who have access to the item, and respect the existing access rules
• surface comments in the file viewer sidebar ([Feature]: Workspace file viewer for images, video, audio, and PDF with sidebar actions #98), which is the natural place for them
• store comments as per-item metadata, scoped and access-checked

Dependencies and sequencing:

• @mentions are only useful if the mentioned user is notified, so this depends on the notification system (Build Notification System Based on User Contact Info (Depends on #90) vault-web#95). Without it, mentions are silent.
• Commenting is most meaningful once items can be shared between users ([Feature]: Implement secure file and folder sharing between users #27), so this is intended to land after viewer, sharing, and favorites, not before.
• This issue deliberately opens follow-up surface (mentions, notifications, permissions, threading, activity). It is scoped as a later workspace feature for that reason.

Acceptance criteria

• Users can add, list, and delete comments on a file or folder.
• Comments support @mentions resolved against existing users.
• A mentioned user is notified through the notification system (Add SHA-256 checksum endpoint for file integrity #95).
• Comments are only visible to users with access to the item, and access is enforced server-side.
• Comments appear in the file viewer sidebar.
• Tests cover creation, deletion, mention resolution, and access control.

Related: surfaced in the file viewer sidebar (#98); depends on notifications (Vault-Web/vault-web#95) and pairs with internal sharing (#27).